Secunia

Qualcomm was contacted in August regarding a bug which allowed maliciously crafted attachment names to be executed without warning.

This can be abused to make the recipient believe that he/she has received a legitimate attachment, when in fact the attachment is an executable file which will be executed without warning when clicked upon.

Alternate ways have been identified allowing attachment spoofing in a way that looks more legitimate. This could be exploited to show a default windows icon instead when infact an executable will be activated, another way allows complete manipulation of the filename, but will show a broken icon. Another method could also be used to execute JavaScript.

See "Other References" for details.

This vulnerability has been reported to exist in version 5.2.1 as well.

Solution
Your email gateway could be configured to filter all mime encoded messages so that only specific types of attachments are allowed.
Further details available in Customer Area

Provided and/or discovered by
Paul Szabo

Changelog
Further details available in Customer Area

Original Advisory
http://lists.netsys.com/pipermail/full-disclosure/2002-August/000908.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area